---
id: GHSA-h5fq-653g-gxrm
aliases:
  - GO-2026-5413
title: ots has a negative expire override that can bypass its secret retention policy
summary: ots has a negative expire override that can bypass its secret retention policy
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: Luzifer
product: github.com/Luzifer/ots
ecosystem: go
affected:
  - github.com/Luzifer/ots < 1.21.5
patched:
  - github.com/Luzifer/ots 1.21.5
published: '2026-05-05'
updated: '2026-07-21'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-h5fq-653g-gxrm'
references:
  - url: 'https://github.com/Luzifer/ots/security/advisories/GHSA-h5fq-653g-gxrm'
  - url: >-
      https://github.com/Luzifer/ots/commit/3511bd18a2bec75bd9c6b4d513f2a90ccf4209b7
  - url: 'https://github.com/Luzifer/ots'
  - url: 'https://github.com/Luzifer/ots/releases/tag/v1.21.5'
tags:
  - osv
  - go
ingestedAt: '2026-07-21T19:04:59.281Z'
---

## Overview

## Summary

The `/api/create` endpoint accepted negative `expire` query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.

## Impact

Unauthenticated users could bypass configured retention expectations for secrets they create by sending `POST /api/create?expire=-1`.

This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.

## Affected versions

Versions up to and including v1.21.4 are affected.

## Patched versions

Fixed in v1.21.5.

## Workarounds

Disable expiry overrides via `disableExpiryOverride: true` until upgrading.

## Credit

Reported by Chai Cheng Xun via email.

## Affected packages

- `github.com/Luzifer/ots < 1.21.5`

## Remediation

Upgrade to a patched release:

- `github.com/Luzifer/ots 1.21.5`